d9577922518c5fd98ec3518daa760289edf5e1151a7aea86e528606dde7563fb

Analysis

max time kernel
137s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2024 08:34

Target

16d7cfecc0d1f44bcf020b5d2c900a64_JaffaCakes118.exe
Size

127KB
MD5

16d7cfecc0d1f44bcf020b5d2c900a64
SHA1

8170d4759a48ae196102b921dc7b89b3bda27886
SHA256

d9577922518c5fd98ec3518daa760289edf5e1151a7aea86e528606dde7563fb
SHA512

a8d69562b780389afe4fa02b16f12577c4654657863fabbdddec721d48194690270f1ea74fe1fa1981577cfa84c77585d765213c3318ecab40018ca7d62fa281
SSDEEP

3072:SCbz/KdJp8JZHIpKx+KDMbrfpaIeiX4d2Vzv9z/ri:SC+fFpWMXUCRVD9/

Score

7^/10

upx

Drops startup file 1 IoCs

Processes:

16d7cfecc0d1f44bcf020b5d2c900a64_JaffaCakes118.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\saohydukhksicao.eu.url	16d7cfecc0d1f44bcf020b5d2c900a64_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/1100-0-0x0000000000400000-0x0000000000435000-memory.dmp	upx
behavioral2/memory/1100-1-0x0000000000400000-0x0000000000435000-memory.dmp	upx
behavioral2/memory/1100-5-0x0000000000400000-0x0000000000435000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1748 1100 WerFault.exe 16d7cfecc0d1f44bcf020b5d2c900a64_JaffaCakes118.exe

pid	pid_target	process	target process
1748	1100	WerFault.exe	16d7cfecc0d1f44bcf020b5d2c900a64_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

16d7cfecc0d1f44bcf020b5d2c900a64_JaffaCakes118.exe

pid	process
1100	16d7cfecc0d1f44bcf020b5d2c900a64_JaffaCakes118.exe
1100	16d7cfecc0d1f44bcf020b5d2c900a64_JaffaCakes118.exe
1100	16d7cfecc0d1f44bcf020b5d2c900a64_JaffaCakes118.exe
1100	16d7cfecc0d1f44bcf020b5d2c900a64_JaffaCakes118.exe
1100	16d7cfecc0d1f44bcf020b5d2c900a64_JaffaCakes118.exe
1100	16d7cfecc0d1f44bcf020b5d2c900a64_JaffaCakes118.exe
1100	16d7cfecc0d1f44bcf020b5d2c900a64_JaffaCakes118.exe
1100	16d7cfecc0d1f44bcf020b5d2c900a64_JaffaCakes118.exe
1100	16d7cfecc0d1f44bcf020b5d2c900a64_JaffaCakes118.exe
1100	16d7cfecc0d1f44bcf020b5d2c900a64_JaffaCakes118.exe
1100	16d7cfecc0d1f44bcf020b5d2c900a64_JaffaCakes118.exe
1100	16d7cfecc0d1f44bcf020b5d2c900a64_JaffaCakes118.exe
1100	16d7cfecc0d1f44bcf020b5d2c900a64_JaffaCakes118.exe
1100	16d7cfecc0d1f44bcf020b5d2c900a64_JaffaCakes118.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 520
2⤵
- Program crash
PID:1748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1100 -ip 1100
1⤵
PID:1632

memory/1100-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1100-1-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1100-2-0x000000000040D000-0x0000000000413000-memory.dmp

Filesize
24KB

Download
memory/1100-5-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download